Martyn's Law guidance: tiers and capacity

Martyn’s Law, the Terrorism (Protection of Premises) Act 2025, requires those in control of certain premises and events to take steps to reduce their vulnerability to acts of terrorism. Two tiers apply: standard, where 200 to 799 people can reasonably be expected at the same time, and enhanced, where 800 or more can. The Act is not yet in force.

This guide explains how the tiers are set and how the expected number of people is assessed. It is not legal advice: the statutory guidance published under the Act is the authoritative text, and the regulator is the Security Industry Authority (SIA), as ProtectUK also sets out.

The short version

• Martyn’s Law is the Terrorism (Protection of Premises) Act 2025. It received Royal Assent on 3 April 2025 and is not yet in force.
• Standard tier: 200 to 799 individuals reasonably expected at the same time, including staff. Enhanced tier: 800 or more. Qualifying events: 800 or more at some point during the event.
• The number is assessed by a reasonable, evidenced method: fire safety occupancy, historic attendance data, fixed positions, tickets, licence restrictions or other justified means.
• No equipment or third-party service is required by the Act. Measurement data can be evidence behind an assessment; it does not make a venue compliant.
• The regulator is the Security Industry Authority.

Which tier does our venue fall into?

Premises qualify when it is reasonable to expect that, from time to time, 200 or more individuals may be present at the same time in connection with one of the uses listed in Schedule 1 of the Act. Schedule 1 covers, among others, shops, food and drink, entertainment and leisure, sports grounds, museums, halls, visitor attractions, hotels, places of worship, health care, stations and aerodromes. Where 800 or more may be present at the same time, the premises are enhanced duty premises; any other qualifying premises are standard duty premises.

A qualifying event is one where 800 or more individuals may reasonably be expected at the same time at some point during the event, entry is by payment, ticket or membership, and the premises are not already enhanced duty premises. The figures include staff.

In the standard tier, the responsible person must notify the SIA and have in place, so far as is reasonably practicable, appropriate public protection procedures: evacuation, invacuation, lockdown and communication. No document is required. In the enhanced tier, and for qualifying events, the responsible person must additionally have public protection measures in place, document procedures and measures, submit the document to the SIA, keep the measures under review and designate a senior individual responsible for compliance.

How is “the number of individuals present at the same time” assessed?

“At the same time” means together or simultaneously: individuals present on the premises together at any one time. The guidance asks for a reasonable method to calculate the greatest expected number, and whatever method is chosen must be evidenced. If the method leaves out staff, they must be added.

Supplementary document A lists six ways to make the assessment:

• A. Safe occupancy for fire safety purposes.
• B. Historic attendance data: records from previous years that reflect actual usage at peak times.
• C. Fixed seating and/or fixed standing positions.
• D. Tickets and pre-registration: the maximum number of tickets that can be issued or people who can register.
• E. Restrictions on attendance, for example a capacity figure attached to an alcohol and entertainment licence.
• F. Other means, together with a justification and supporting evidence.

Historic data should be reviewed regularly, since past attendance is not always a reliable predictor of the future. The figures and the assumptions behind them should be kept under review, and the SIA can require information about how the assessment was carried out.

Can footfall data support the capacity assessment?

Measurement data can be part of the evidence behind an assessment. It does not make a venue compliant, and it is not required: there is no statutory requirement in the Act to purchase specific equipment, and it is not mandatory to use third-party products or services to comply. The assessment, and the choice of method, remain the responsible person’s.

Where the guidance accepts historic attendance data at peak times, or other means with supporting evidence, a venue that already measures visitors has a record to draw on. Entry and exit sensors register each person entering or leaving a defined zone, and the system keeps a running count: current occupancy equals cumulative entries minus cumulative exits. Over months, the live data builds up a record of how occupancy varies by hour, day, week and season. The output is entirely aggregated: the system knows how many people a zone holds, but not who any of them are. Visitors are counted as anonymous, aggregated flows, and no guest is ever identified. Bumbee Labs is the company behind the only footfall method in Europe approved by a data protection authority.

Tickets count each admission once, at the gate. Visitor measurement shows how crowds distribute and how flows shift hour by hour. For formal crowd-safety planning, your safety organisation can work from the same data as its evidence base. At entrances, optical 3D sensors or LiDAR give directional in/out counts and live occupancy against a set limit. Wi-Fi-based measurement covers wide and outdoor areas.

Who enforces Martyn’s Law, and from when?

The Act confers the regulatory functions on the Security Industry Authority. According to the Home Office factsheet, enforcement tools include compliance notices, monetary penalties and restriction notices; the legislation also includes some criminal offences.

The Act received Royal Assent on 3 April 2025. Its substantive requirements come into force on a day appointed by regulations, and that day has not been set. The government has said the implementation period is at least 24 months from Royal Assent, that there is no legal requirement to comply until then, and that further details on commencement will be provided. (Checked 12 October 2026.)

What should an operator do now?

Read the statutory guidance and check whether your premises or event falls within a Schedule 1 use and the 200 or 800 thresholds. Choose a reasonable method for the greatest expected number, evidence it, add staff if the method leaves them out, and keep the figure under review. Nothing has to be bought or installed for this, and there is no legal requirement to comply until the Act is in force.

If you already measure visitors, or run a venue where real-time crowding matters at peaks and breaks, the record you build is one piece of evidence an assessment can rest on. The assessment, and the duties that follow from the tier, stay with the responsible person.